Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • Sample

    241114-1fpv2axkdj

  • MD5

    f9f8be2116fea5c842ab4895a2e70d12

  • SHA1

    5e1f7ab196b07c26dffeadfd3b0810cbba0dcbb7

  • SHA256

    1892623fff63caef48260a03265379b7bcd59acca9f434430275aabb21d30b22

  • SHA512

    6014c71c5897951c24042b31d8bb1f66f922dd67f6c8cf201036f007ab40b31023c941af6811f8e780234e557d4c74abccaa1107fd444665853a0010f7c84988

  • SSDEEP

    49152:fv+I22SsaNYfdPBldt698dBcjHEBRJ6KbR3LoGdjLTHHB72eh2NT:fvz22SsaNYfdPBldt6+dBcjHEBRJ6k

Score
10/10
quasarniggletspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Nigglet

C2

216.212.14.30:4782

Mutex

97ffcfba-f5de-45ae-9077-2e16c08140cd

Attributes
  • encryption_key

    DEACA68FF61AC6C3B70166029A2DAC3B43CB3B82

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      Client-built.exe

    • Size

      3.1MB

    • MD5

      f9f8be2116fea5c842ab4895a2e70d12

    • SHA1

      5e1f7ab196b07c26dffeadfd3b0810cbba0dcbb7

    • SHA256

      1892623fff63caef48260a03265379b7bcd59acca9f434430275aabb21d30b22

    • SHA512

      6014c71c5897951c24042b31d8bb1f66f922dd67f6c8cf201036f007ab40b31023c941af6811f8e780234e557d4c74abccaa1107fd444665853a0010f7c84988

    • SSDEEP

      49152:fv+I22SsaNYfdPBldt698dBcjHEBRJ6KbR3LoGdjLTHHB72eh2NT:fvz22SsaNYfdPBldt6+dBcjHEBRJ6k

    Score
    10/10
    quasarniggletspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks